ssh-over-sse-cli 0.1.0__tar.gz

ssh_over_sse_cli-0.1.0/.gitignore

@@ -0,0 +1,10 @@
+.venv/
+__pycache__/
+*.py[cod]
+.pytest_cache/
+.ruff_cache/
+.mypy_cache/
+dist/
+*.egg-info/
+.runtime/
+.coverage

ssh_over_sse_cli-0.1.0/PKG-INFO

@@ -0,0 +1,131 @@
+Metadata-Version: 2.5
+Name: ssh-over-sse-cli
+Version: 0.1.0
+Summary: OpenSSH ProxyCommand client for ssh-sse/v1
+Requires-Python: >=3.12
+Requires-Dist: cryptography>=45
+Requires-Dist: httpx<1,>=0.28
+Requires-Dist: pyyaml<7,>=6
+Description-Content-Type: text/markdown
+
+# ssh-sse-cli
+
+Connect to SSH servers through an HTTPS gateway with your usual OpenSSH commands.
+
+## Install
+
+Requires Linux or macOS, Python 3.12 or newer, and OpenSSH.
+
+With uv:
+
+```sh
+uv tool install --python 3.12 ssh-over-sse-cli
+```
+
+Or with pip:
+
+```sh
+pip install 'ssh-over-sse[cli]'
+```
+
+Use `ssh-over-sse[all]` with pip to install the gateway command too.
+Supported keys are Ed25519, RSA (2048–8192 bits), and ECDSA (P-256, P-384, P-521).
+Load encrypted keys into `ssh-agent` before use.
+
+## Configure SSH
+
+Ask your administrator for the gateway URL and an allowed destination. Add an
+entry to your SSH configuration, replacing the example values:
+
+```sshconfig
+Host my-server
+    HostName 192.0.2.20
+    Port 22
+    User alice
+    IdentityFile ~/.ssh/id_ed25519
+    IdentitiesOnly yes
+    StrictHostKeyChecking yes
+    ProxyCommand ssh-sse-cli --url https://gateway.example.com --ssh-host %n
+```
+
+Connect or transfer files normally:
+
+```sh
+ssh my-server
+scp report.txt my-server:report.txt
+sftp my-server
+```
+
+The client reads the destination, port, SSH user, and first available identity
+from the selected host. `--target`, `--user`, and `-i` override those values.
+If you use `ssh -F`, pass the same file using `--ssh-config` in the ProxyCommand.
+To pass outer command-line user or port overrides, add `--user %r --target %h:%p`.
+
+Your public key must be authorized by the gateway account and destination server.
+Your private key stays on your computer. Keep SSH host-key verification enabled.
+
+## Check your key
+
+Open the gateway URL in a browser to view the landing page. Then run:
+
+```sh
+ssh-sse-cli --url https://gateway.example.com check
+```
+
+Without a host alias, the identity defaults to `~/.ssh/id_ed25519`. To select a
+key or use an existing SSH host's identity:
+
+```sh
+ssh-sse-cli --url https://gateway.example.com -i ~/.ssh/id_ecdsa check
+ssh-sse-cli --url https://gateway.example.com --ssh-host my-server check
+```
+
+The check requires no destination or SSH user. It verifies gateway access without
+connecting to a destination. Success prints
+`Gateway SSH key authentication succeeded.` and exits with status 0. Errors exit
+with status 1. HTTP 401 means the key was rejected; HTTP 500 indicates a gateway
+or server error.
+
+For a direct backend check, use its HTTP address:
+
+```sh
+ssh-sse-cli --url http://192.0.2.10:7010 -i ~/.ssh/id_ecdsa check
+```
+
+SSH connections use the public HTTPS URL. A successful key check does not confirm
+destination permissions or the destination's SSH login.
+
+## Options
+
+| Option | Purpose |
+| --- | --- |
+| `--url` | Gateway root URL |
+| `--ssh-host` | Read connection and identity settings from an SSH host alias |
+| `--ssh-config` | Read an alternate SSH configuration file |
+| `--target` | Override the destination as `HOST:PORT`; bracket IPv6 addresses |
+| `--user` | Override the destination SSH username |
+| `-i`, `--identity` | Select an identity file |
+| `--config` | Read client settings from a file |
+| `--ca-file` | Trust a private HTTPS certificate authority |
+| `--log-level` | Set diagnostics to `DEBUG`, `INFO`, `WARNING`, or `ERROR` |
+
+Client settings default to `~/.config/ssh-over-sse/client.yaml` when that file
+exists. Store your gateway URL there to omit `--url`:
+
+```yaml
+url: https://gateway.example.com
+```
+
+Command-line options take precedence. Connection diagnostics appear on stderr;
+`check` prints its success message on stdout.
+
+## Troubleshooting
+
+If authentication fails, check the URL, selected key, and gateway authorization.
+For encrypted keys, check that the identity is loaded into `ssh-agent`. Ask your
+administrator to confirm destination permissions if the key check succeeds but
+SSH cannot connect. After an interruption, start a new connection.
+
+```sh
+ssh-sse-cli --help
+```

ssh_over_sse_cli-0.1.0/README.md

@@ -0,0 +1,121 @@
+# ssh-sse-cli
+
+Connect to SSH servers through an HTTPS gateway with your usual OpenSSH commands.
+
+## Install
+
+Requires Linux or macOS, Python 3.12 or newer, and OpenSSH.
+
+With uv:
+
+```sh
+uv tool install --python 3.12 ssh-over-sse-cli
+```
+
+Or with pip:
+
+```sh
+pip install 'ssh-over-sse[cli]'
+```
+
+Use `ssh-over-sse[all]` with pip to install the gateway command too.
+Supported keys are Ed25519, RSA (2048–8192 bits), and ECDSA (P-256, P-384, P-521).
+Load encrypted keys into `ssh-agent` before use.
+
+## Configure SSH
+
+Ask your administrator for the gateway URL and an allowed destination. Add an
+entry to your SSH configuration, replacing the example values:
+
+```sshconfig
+Host my-server
+    HostName 192.0.2.20
+    Port 22
+    User alice
+    IdentityFile ~/.ssh/id_ed25519
+    IdentitiesOnly yes
+    StrictHostKeyChecking yes
+    ProxyCommand ssh-sse-cli --url https://gateway.example.com --ssh-host %n
+```
+
+Connect or transfer files normally:
+
+```sh
+ssh my-server
+scp report.txt my-server:report.txt
+sftp my-server
+```
+
+The client reads the destination, port, SSH user, and first available identity
+from the selected host. `--target`, `--user`, and `-i` override those values.
+If you use `ssh -F`, pass the same file using `--ssh-config` in the ProxyCommand.
+To pass outer command-line user or port overrides, add `--user %r --target %h:%p`.
+
+Your public key must be authorized by the gateway account and destination server.
+Your private key stays on your computer. Keep SSH host-key verification enabled.
+
+## Check your key
+
+Open the gateway URL in a browser to view the landing page. Then run:
+
+```sh
+ssh-sse-cli --url https://gateway.example.com check
+```
+
+Without a host alias, the identity defaults to `~/.ssh/id_ed25519`. To select a
+key or use an existing SSH host's identity:
+
+```sh
+ssh-sse-cli --url https://gateway.example.com -i ~/.ssh/id_ecdsa check
+ssh-sse-cli --url https://gateway.example.com --ssh-host my-server check
+```
+
+The check requires no destination or SSH user. It verifies gateway access without
+connecting to a destination. Success prints
+`Gateway SSH key authentication succeeded.` and exits with status 0. Errors exit
+with status 1. HTTP 401 means the key was rejected; HTTP 500 indicates a gateway
+or server error.
+
+For a direct backend check, use its HTTP address:
+
+```sh
+ssh-sse-cli --url http://192.0.2.10:7010 -i ~/.ssh/id_ecdsa check
+```
+
+SSH connections use the public HTTPS URL. A successful key check does not confirm
+destination permissions or the destination's SSH login.
+
+## Options
+
+| Option | Purpose |
+| --- | --- |
+| `--url` | Gateway root URL |
+| `--ssh-host` | Read connection and identity settings from an SSH host alias |
+| `--ssh-config` | Read an alternate SSH configuration file |
+| `--target` | Override the destination as `HOST:PORT`; bracket IPv6 addresses |
+| `--user` | Override the destination SSH username |
+| `-i`, `--identity` | Select an identity file |
+| `--config` | Read client settings from a file |
+| `--ca-file` | Trust a private HTTPS certificate authority |
+| `--log-level` | Set diagnostics to `DEBUG`, `INFO`, `WARNING`, or `ERROR` |
+
+Client settings default to `~/.config/ssh-over-sse/client.yaml` when that file
+exists. Store your gateway URL there to omit `--url`:
+
+```yaml
+url: https://gateway.example.com
+```
+
+Command-line options take precedence. Connection diagnostics appear on stderr;
+`check` prints its success message on stdout.
+
+## Troubleshooting
+
+If authentication fails, check the URL, selected key, and gateway authorization.
+For encrypted keys, check that the identity is loaded into `ssh-agent`. Ask your
+administrator to confirm destination permissions if the key check succeeds but
+SSH cannot connect. After an interruption, start a new connection.
+
+```sh
+ssh-sse-cli --help
+```

ssh_over_sse_cli-0.1.0/pyproject.toml

@@ -0,0 +1,29 @@
+[project]
+name = "ssh-over-sse-cli"
+version = "0.1.0"
+readme = "README.md"
+description = "OpenSSH ProxyCommand client for ssh-sse/v1"
+requires-python = ">=3.12"
+dependencies = ["httpx>=0.28,<1", "pyyaml>=6,<7", "cryptography>=45"]
+[project.scripts]
+ssh-sse-cli = "ssh_sse_tool.cli:main"
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+[dependency-groups]
+dev = ["pytest>=8", "pytest-asyncio>=1", "ruff>=0.12", "mypy>=1.16", "types-PyYAML"]
+[tool.pytest.ini_options]
+asyncio_mode = "auto"
+asyncio_default_fixture_loop_scope = "function"
+[tool.ruff]
+line-length = 100
+[tool.ruff.lint]
+select = ["E4", "E7", "E9", "F", "I"]
+[tool.mypy]
+check_untyped_defs = true
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/ssh_sse_tool"]
+
+[tool.hatch.build.targets.sdist]
+include = ["/pyproject.toml", "/README.md", "/uv.lock", "/src"]

ssh_over_sse_cli-0.1.0/src/ssh_sse_tool/__init__.py

@@ -0,0 +1 @@
+"""SSH-over-SSE ProxyCommand client."""

ssh_over_sse_cli-0.1.0/src/ssh_sse_tool/auth.py

@@ -0,0 +1,65 @@
+"""OpenSSH SSHSIG signer, including public-key path + ssh-agent support."""
+
+import asyncio
+import base64
+import hashlib
+from pathlib import Path
+
+from cryptography.exceptions import UnsupportedAlgorithm
+from cryptography.hazmat.primitives.asymmetric.ec import EllipticCurvePublicKey
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
+from cryptography.hazmat.primitives.asymmetric.rsa import RSAPublicKey
+from cryptography.hazmat.primitives.serialization import Encoding, PublicFormat, load_ssh_public_key
+
+
+async def command(*args, data=None):
+    process = await asyncio.create_subprocess_exec(
+        *args,
+        stdin=asyncio.subprocess.PIPE if data is not None else asyncio.subprocess.DEVNULL,
+        stdout=asyncio.subprocess.PIPE,
+        stderr=asyncio.subprocess.DEVNULL,
+    )
+    try:
+        stdout, _ = await asyncio.wait_for(process.communicate(data), 10)
+        if process.returncode:
+            raise ValueError("SSH key operation failed; load your identity into ssh-agent")
+        return stdout
+    finally:
+        if process.returncode is None:
+            process.kill()
+            await process.wait()
+
+
+async def identity_key(identity):
+    path = Path(identity)
+    pub = path if path.suffix == ".pub" else Path(str(path) + ".pub")
+    if pub.is_file():
+        if pub.stat().st_size > 8192:
+            raise ValueError("public key too large")
+        line = pub.read_bytes().strip()
+    else:
+        line = (await command("ssh-keygen", "-y", "-f", str(path))).strip()
+    try:
+        key = load_ssh_public_key(line)
+    except UnsupportedAlgorithm:
+        raise ValueError("unsupported SSH public key") from None
+    if not isinstance(key, (Ed25519PublicKey, RSAPublicKey, EllipticCurvePublicKey)):
+        raise ValueError("unsupported SSH public key")
+    if isinstance(key, RSAPublicKey) and not 2048 <= key.key_size <= 8192:
+        raise ValueError("RSA keys must be 2048 to 8192 bits")
+    if isinstance(key, EllipticCurvePublicKey) and key.curve.name not in (
+        "secp256r1",
+        "secp384r1",
+        "secp521r1",
+    ):
+        raise ValueError("unsupported ECDSA curve")
+    normalized = key.public_bytes(Encoding.OpenSSH, PublicFormat.OpenSSH).decode()
+    blob = base64.b64decode(normalized.split()[1], validate=True)
+    fp = "SHA256:" + base64.b64encode(hashlib.sha256(blob).digest()).decode().rstrip("=")
+    return normalized, fp
+
+
+async def sign(identity, namespace, message):
+    return base64.b64encode(
+        await command("ssh-keygen", "-Y", "sign", "-f", identity, "-n", namespace, data=message)
+    ).decode()

ssh_over_sse_cli-0.1.0/src/ssh_sse_tool/cli.py

@@ -0,0 +1,86 @@
+"""Local OpenSSH ProxyCommand entrypoint. stdout is raw SSH bytes only."""
+
+import argparse
+import asyncio
+import logging
+import signal
+import sys
+
+import httpx
+import yaml
+
+from .config import settings
+from .stdio import Stdio
+from .transport import GatewayError, Transport
+
+
+async def run(config):
+    stdio = Stdio()
+    task = asyncio.current_task()
+    assert task is not None
+    loop = asyncio.get_running_loop()
+    for sig in (signal.SIGINT, signal.SIGTERM):
+        loop.add_signal_handler(sig, task.cancel)
+    try:
+        await Transport(config).run(stdio)
+    finally:
+        stdio.close()
+        for sig in (signal.SIGINT, signal.SIGTERM):
+            loop.remove_signal_handler(sig)
+
+
+def main():
+    parser = argparse.ArgumentParser(
+        prog="ssh-sse-cli", description="OpenSSH ProxyCommand over HTTPS POST + SSE"
+    )
+    parser.add_argument(
+        "command",
+        nargs="?",
+        choices=["check"],
+        help="verify gateway access with your SSH key without connecting to a target",
+    )
+    for name in (
+        "url",
+        "target",
+        "user",
+        "config",
+        "log-level",
+        "ca-file",
+        "ssh-host",
+        "ssh-config",
+    ):
+        parser.add_argument("--" + name)
+    parser.add_argument("-i", "--identity", help="SSH identity file")
+    parser.add_argument(
+        "--test-only-allow-http-localhost", action="store_true", help=argparse.SUPPRESS
+    )
+    args = parser.parse_args()
+    try:
+        config = settings(args)
+        # HTTP-library debug logs can contain authorization headers: never enable them.
+        logging.basicConfig(level=getattr(logging, config.log_level), stream=sys.stderr)
+        logging.getLogger("httpx").setLevel(logging.CRITICAL)
+        logging.getLogger("httpcore").setLevel(logging.CRITICAL)
+        if args.command == "check":
+            asyncio.run(Transport(config).check())
+            print("Gateway SSH key authentication succeeded.")
+        else:
+            asyncio.run(run(config))
+    except GatewayError as error:
+        parser.exit(1, f"ssh-sse-cli: {error}\n")
+    except (
+        ValueError,
+        OSError,
+        TimeoutError,
+        TypeError,
+        KeyError,
+        RecursionError,
+        yaml.YAMLError,
+        httpx.HTTPError,
+    ):
+        parser.exit(
+            1,
+            "ssh-sse-cli: authentication or transport failed; check configuration, key agent and gateway audit logs\n",
+        )
+    except (KeyboardInterrupt, asyncio.CancelledError):
+        parser.exit(130, "ssh-sse-cli: interrupted\n")

ssh_over_sse_cli-0.1.0/src/ssh_sse_tool/config.py

@@ -0,0 +1,242 @@
+"""Client arguments/config validation, with no production TLS bypass."""
+
+import getpass
+import ipaddress
+import os
+import re
+import socket
+import subprocess
+from dataclasses import dataclass
+from pathlib import Path
+from urllib.parse import urlsplit
+
+import yaml
+
+
+class UniqueLoader(yaml.SafeLoader):
+    pass
+
+
+def unique_mapping(loader, node):
+    result = {}
+    for k, v in node.value:
+        key = loader.construct_object(k)
+        if not isinstance(key, str) or key in result:
+            raise ValueError("duplicate config key")
+        result[key] = loader.construct_object(v)
+    return result
+
+
+UniqueLoader.add_constructor(yaml.resolver.BaseResolver.DEFAULT_MAPPING_TAG, unique_mapping)
+
+
+def target(value):
+    if not isinstance(value, str) or any(c.isspace() for c in value):
+        raise ValueError("invalid target")
+    pattern = r"\[([^\]]+)\]:([0-9]+)" if value.startswith("[") else r"([^:\[\]]+):([0-9]+)"
+    match = re.fullmatch(pattern, value)
+    if not match or not 1 <= int(match[2]) <= 65535:
+        raise ValueError("target must be HOST:PORT (bracket IPv6)")
+    host = match[1]
+    try:
+        host = str(ipaddress.ip_address(host))
+    except ValueError:
+        if not re.fullmatch(r"[a-zA-Z0-9][a-zA-Z0-9.-]{0,252}", host):
+            raise ValueError("invalid target host") from None
+    return host, int(match[2])
+
+
+def base_url(value, test_only_http=False, *, allow_http_check=False):
+    if not isinstance(value, str) or any(c.isspace() for c in value):
+        raise ValueError("invalid gateway URL")
+    parsed = urlsplit(value)
+    if not parsed.hostname or parsed.username or parsed.password or parsed.query or parsed.fragment:
+        raise ValueError("invalid gateway URL")
+    if parsed.scheme != "https":
+        if (not test_only_http and not allow_http_check) or parsed.scheme != "http":
+            raise ValueError("HTTPS is required")
+        try:
+            loopback = ipaddress.ip_address(parsed.hostname).is_loopback
+        except ValueError:
+            loopback = parsed.hostname == "localhost"
+        if not loopback and not allow_http_check:
+            raise ValueError("test HTTP requires loopback")
+    if not re.fullmatch(r"(?:/[a-zA-Z0-9_-]+)*/?", parsed.path):
+        raise ValueError("invalid base URL path")
+    _ = parsed.port  # validate port syntax/range
+    return value.rstrip("/")
+
+
+@dataclass(frozen=True)
+class Settings:
+    url: str
+    host: str
+    port: int
+    user: str
+    principal: str | None
+    identity: str
+    namespace: str = "ssh-sse-gateway@your-organization.example"
+    ca_file: str | None = None
+    request_timeout: float = 30
+    stream_timeout: float = 75
+    log_level: str = "WARNING"
+
+
+def ssh_defaults(alias, config_file=None, user=None):
+    """Read effective local OpenSSH configuration without opening a connection."""
+    if not isinstance(alias, str) or not re.fullmatch(r"[A-Za-z0-9_.:@\[\]-]{1,253}", alias):
+        raise ValueError("invalid SSH host alias")
+    command = ["ssh", "-G"]
+    if config_file is not None:
+        if not isinstance(config_file, str):
+            raise ValueError("invalid SSH config path")
+        command.extend(["-F", str(Path(config_file).expanduser())])
+    if user is not None:
+        if not isinstance(user, str) or not re.fullmatch(r"[a-zA-Z0-9_@.+-]{1,128}", user):
+            raise ValueError("invalid SSH user")
+        command.extend(["-l", user])
+    command.extend(["--", alias])
+    try:
+        result = subprocess.run(
+            command,
+            stdin=subprocess.DEVNULL,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.DEVNULL,
+            text=True,
+            timeout=5,
+            check=False,
+        )
+    except (OSError, subprocess.SubprocessError):
+        raise ValueError("cannot read effective SSH configuration") from None
+    if result.returncode or len(result.stdout) > 1048576:
+        raise ValueError("cannot read effective SSH configuration")
+    values: dict[str, str] = {}
+    identities = []
+    for line in result.stdout.splitlines():
+        name, separator, value = line.partition(" ")
+        if not separator:
+            continue
+        if name == "identityfile":
+            identities.append(value)
+        elif name in ("hostname", "port", "user"):
+            values.setdefault(name, value)
+    if set(values) != {"hostname", "port", "user"}:
+        raise ValueError("incomplete effective SSH configuration")
+    hostname = values["hostname"]
+    tokens = {
+        "%": "%",
+        "d": str(Path.home()),
+        "h": hostname,
+        "n": alias,
+        "r": values["user"],
+        "p": values["port"],
+        "u": getpass.getuser(),
+        "i": str(os.getuid()),
+        "l": socket.gethostname(),
+    }
+    for identity in identities:
+        if identity.lower() == "none":
+            continue
+
+        def expand(match):
+            if match[1] not in tokens:
+                raise ValueError("unsupported IdentityFile token; specify --identity")
+            return tokens[match[1]]
+
+        path = Path(os.path.expandvars(re.sub(r"%(.)", expand, identity))).expanduser()
+        if path.is_file():
+            values["identity"] = str(path)
+            break
+        public = Path(str(path) + ".pub")
+        if public.is_file():
+            values["identity"] = str(public)
+            break
+    host = f"[{hostname}]" if ":" in hostname else hostname
+    values["target"] = host + ":" + values["port"]
+    return values
+
+
+def settings(args):
+    raw = {}
+    default_config = Path.home() / ".config/ssh-over-sse/client.yaml"
+    config_path = args.config or (str(default_config) if default_config.is_file() else None)
+    if config_path:
+        path = Path(config_path).expanduser()
+        if path.stat().st_size > 65536:
+            raise ValueError("config too large")
+        raw = yaml.load(path.read_text(), Loader=UniqueLoader)
+        allowed = {
+            "url",
+            "target",
+            "user",
+            "principal",
+            "identity",
+            "namespace",
+            "ca_file",
+            "request_timeout",
+            "stream_timeout",
+            "log_level",
+            "ssh_host",
+            "ssh_config",
+        }
+        if not isinstance(raw, dict) or set(raw) - allowed:
+            raise ValueError("invalid client config")
+    for key in (
+        "url",
+        "target",
+        "user",
+        "identity",
+        "log_level",
+        "ca_file",
+        "ssh_host",
+        "ssh_config",
+    ):
+        value = getattr(args, key, None)
+        if value is not None:
+            raw[key] = value
+    alias = raw.pop("ssh_host", None)
+    ssh_config = raw.pop("ssh_config", None)
+    if alias is not None:
+        defaults = ssh_defaults(alias, ssh_config, raw.get("user"))
+        for key in ("target", "user", "identity"):
+            if key in defaults:
+                raw.setdefault(key, defaults[key])
+        if "identity" not in raw:
+            raise ValueError("no usable IdentityFile for this host; specify --identity")
+    elif ssh_config is not None:
+        raise ValueError("--ssh-config requires --ssh-host")
+    if getattr(args, "command", None) == "check":
+        # Settings retains its transport fields; check proofs carry no destination.
+        raw.setdefault("target", "localhost:22")
+        raw.setdefault("user", getpass.getuser())
+    raw.setdefault("identity", "~/.ssh/id_ed25519")
+    for key in ("url", "target", "user", "identity"):
+        if not isinstance(raw.get(key), str) or not raw[key]:
+            raise ValueError(f"{key} is required")
+    host, port = target(raw.pop("target"))
+    raw["url"] = base_url(
+        raw["url"],
+        args.test_only_allow_http_localhost,
+        allow_http_check=getattr(args, "command", None) == "check",
+    )
+    raw.setdefault("principal", None)
+    for key in ("user", "principal"):
+        if key == "principal" and raw[key] is None:
+            continue
+        if not isinstance(raw[key], str) or not re.fullmatch(r"[a-zA-Z0-9_@.+-]{1,128}", raw[key]):
+            raise ValueError("invalid user/principal")
+    for key in ("request_timeout", "stream_timeout"):
+        if key in raw and (type(raw[key]) not in (int, float) or not 0 < raw[key] <= 604800):
+            raise ValueError("invalid timeout")
+    if "namespace" in raw and (
+        not isinstance(raw["namespace"], str) or not re.fullmatch(r"[^\s]{1,255}", raw["namespace"])
+    ):
+        raise ValueError("invalid namespace")
+    if raw.get("log_level", "WARNING") not in ("DEBUG", "INFO", "WARNING", "ERROR"):
+        raise ValueError("invalid log level")
+    if "ca_file" in raw and not isinstance(raw["ca_file"], str):
+        raise ValueError("invalid CA file")
+    raw["identity"] = str(Path(raw["identity"]).expanduser().resolve())
+    if raw.get("ca_file"):
+        raw["ca_file"] = str(Path(raw["ca_file"]).expanduser())
+    return Settings(host=host, port=port, **raw)